Back to blog
Routers

How We Built Smart Routing for the Router You Already Own

Why we put Throughwire on the GL.iNet router people already buy, why setup runs from a laptop, and how the router keeps Chinese apps local and updates itself.

Updated October 2026.

The short answer

We built Throughwire's router setup so a home or office in China can cover every device with one GL.iNet router, without reflashing or config files. Setup runs from a laptop because the laptop already has a working connection. Afterwards the router keeps Chinese apps local, refreshes its China lists, installs signed updates and recovers after power cuts by itself.

Table of contents

Why doesn't one VPN app per device work for an office or a family?

For one person, a VPN app on a phone and a laptop works well. In an office or a family home in China, the app-on-every-device approach breaks in the same places again and again:

  • Devices that cannot run a VPN app. Smart TVs, Apple TV, game consoles, printers, meeting-room screens and video conference systems either have no app store or no VPN support.
  • Guests and new staff. Every visitor, new hire or visiting grandparent needs an app installed and a login before they can use Google, WhatsApp or Zoom.
  • Forgetting to switch on. Someone opens a laptop, the VPN is off, and Gmail does not load. Multiply that by ten people and it happens every day.
  • Chinese apps misbehaving. Leave the VPN on for everything and WeChat, Alipay or a banking app can slow down or act differently, because their traffic is being sent abroad and back. Our guide on why WeChat and Alipay break with a VPN on explains this in detail.

The fix for all four is to move the work from every device to the one box they all share: the router. Every device on the Wi-Fi is covered, nobody installs anything, and the router decides for each connection whether it goes direct or through Throughwire.

Why did we build on routers people already buy?

We chose not to ship a box of our own. A router you can buy locally is easier to get and easier to replace, and many of our customers already owned a good one.

GL.iNet routers were the natural choice:

  • They are easy to buy in China. Units from JD.com, Tmall and Taobao work with Throughwire. China-market units hide GL.iNet's own VPN menu, but Throughwire does not use that menu, so it does not matter.
  • They run OpenWrt underneath, an open-source router system with a large community, so the same work also covers routers already running OpenWrt 24.10 or 25.12.
  • No reflashing. Throughwire runs on GL.iNet's own firmware. You keep the router's normal admin page and Wi-Fi settings.

GL.iNet's built-in VPN dashboard supports WireGuard and OpenVPN, with policy rules for chosen devices and for domain or IP lists you enter or subscribe to yourself. It does not come with a list of Chinese services (GL.iNet documentation). That list, and keeping it current, is the part people in China need most, so it is the part we built.

On our service on 23 October 2026, about 53% of active routers were Flint 2 (GL-MT6000), 13% Beryl AX (GL-MT3000), 13% Opal (GL-SFT1200) and 5% Beryl 7 (GL-MT3600BE), with the rest other GL.iNet and OpenWrt devices. Our guide to which GL.iNet router to buy for China covers models in detail.

Why does setup run from a laptop instead of the router?

This was the most important design decision, and it comes from a very China-specific problem.

A router needs software and lists to do smart routing: the routing engine itself, plus the lists of Chinese websites and addresses. Those normally come from sites such as GitHub, which are blocked or unreliable from inside China. A brand-new router with no VPN cannot reliably download the things it needs to get past the block. It is stuck before it starts.

The laptop does not have that problem. You bought Throughwire on it, and it can reach our website. So the setup runs on the laptop:

  1. You create a one-time router code in your Throughwire account.
  2. You paste one command into Terminal on a Mac or PowerShell on Windows, with the laptop on the router's Wi-Fi.
  3. The laptop downloads everything the router needs from our own site, checks it, and copies it to the router over your local network.
  4. You enter the code and the router's admin password. Your long-term subscription link is never typed, pasted or shown.
  5. The setup tests itself from the router before finishing: that Chinese sites go direct and international sites go through Throughwire.

The whole process takes a few minutes. If something goes wrong, the setup shows a short error code that our support team can look up.

To our knowledge (as of October 2026), Throughwire is the first China service that sets up the GL.iNet router you already own with one command from your Mac or Windows PC. No reflashing, no config files.

How does the router know which apps are Chinese?

The router carries two kinds of list: Chinese websites and services by name, and Chinese network addresses. Every connection is checked against them.

Stays on your normal China connection (no Throughwire data used)Goes through Throughwire
WeChat and WeCom, QQ, DingTalkGoogle Search, Gmail and Workspace, YouTube
Alipay, UnionPay, Taobao and Tmall, JD.com, PinduoduoChatGPT and OpenAI, Claude
Douyin, Kuaishou, Bilibili, iQIYI, Youku, Tencent VideoZoom, Slack, Microsoft 365 and Teams
Meituan, Ele.me, Didi, Amap, Ctrip and Trip.comWhatsApp, Instagram, Facebook, X, LinkedIn
Baidu, Weibo, Xiaohongshu (RED), NetEaseNetflix, Disney+, Spotify, Reddit, Discord
Apple services, Xiaomi, Huawei, Steam ChinaGitHub, Dropbox, TikTok

Anything the router cannot positively identify as China-local goes through Throughwire. That way a new international app works the day it launches, without anyone changing settings. You can look up any service in our router routing directory.

The lists are not frozen at setup. We review service families as apps change, and routers check for signed routing updates every few hours, install them on their own, and keep the previous policy if a check fails. The address list covers mainland China only, so servers that Chinese cloud providers run abroad are reached through Throughwire like any other international address.

How does the router keep itself up to date?

A router that only works on the day it was set up is not much use to an office. So after setup:

  • Software updates install by themselves, overnight between 2 am and 6 am China time.
  • Every update is signed. The router checks the signature before installing anything, so it only accepts updates that come from us.
  • Every update is tested on the router. If an update fails its test, the router goes back to the previous version on its own.
  • Remote help uses a short, fixed list of actions: a health check, a restart, a list refresh, an update. There is no remote access to your network, and your browsing is never collected.

Routers set up before October 2026 still get the routing lists automatically. To get automatic software updates as well, run the setup once more from your account.

How do you choose a route?

Near the end of setup, the router shows a short menu of routes out of China: Los Angeles (High Speed), and Osaka or Singapore (Ultra). Next to each one is the latency measured from your router at that moment, not a figure from a brochure.

Los Angeles is recommended and preselected, because it suits about 95% of people and counts data at the normal rate. Ultra suits real-time work such as remote desktop and SSH, and counts 2.5 times the data. To change your route later, run the setup again. Our guide to choosing between Los Angeles, Osaka and Singapore goes through the choice.

What happens after a power cut?

Power cuts, unplugged cables and modem restarts are normal in offices and apartments. The router is built for them:

  • It reconnects by itself after a power cut or restart, with no laptop and no button press.
  • It does not let traffic slip out. If the Throughwire connection stops for any reason, the router holds traffic back instead of sending it out unprotected, and restarts the connection automatically.
  • Moving is easy. Take the router to a new flat or office, plug it into the new internet router, and it carries on.

Whose work did we build on?

China split routing on routers is not new, and we did not invent it. Open-source projects have offered it on OpenWrt routers for years, and anyone who has used them will recognise the idea:

  • ShellCrash, a script-based tool for running proxy engines on OpenWrt routers and Linux.
  • OpenClash, a rule-based proxy plugin for OpenWrt's web interface.
  • PassWall, an OpenWrt package that bundles several proxy engines.

These projects are powerful and flexible, and they reward people who enjoy configuring a router. What we added is packaging for people who do not: one command from a laptop, a service and routing lists that are maintained for you, signed automatic updates, and support from a team that can see your router's health. We also build on sing-box, the open-source routing engine the router runs, and on the OpenWrt project itself.

When Throughwire isn't the right choice

  • You enjoy running your own router setup. If you want full control over every rule and engine, the open-source tools above are a better fit than a managed service.
  • Your router is too small. Models with 16 MB of storage (such as the Mango, AR300M16 or AR750) and the original Beryl (GL-MT1300) cannot run Throughwire. You need an arm64 or armv7 router with at least 256 MB of RAM and 30 MB of free storage.
  • You only need one phone covered. If you live alone and never use a TV or console online, the Throughwire app on your phone may be all you need.
  • Your company needs a licensed cross-border line. Our guide to office internet options in China explains when that is the right answer.

Common questions

Do I need to reflash my GL.iNet router?

No. Throughwire runs on GL.iNet's own firmware. You keep the normal admin page and settings, and the setup checks your model before it starts.

Does a router bought in China work?

Yes. Units from JD.com, Tmall and Taobao work. China-market units hide GL.iNet's own VPN menu, but Throughwire does not use it.

Why can't the router download its own software?

Because a new router in China has no working international connection yet, and the software and lists normally live on sites that are blocked or unreliable from China. The laptop already has a working connection, so it fetches everything and copies it to the router.

Do Chinese apps use my Throughwire data?

No. Services identified as Chinese, such as WeChat, Alipay and Taobao, go direct on your normal line and do not count towards your allowance.

What happens if an update goes wrong?

The router tests every update before keeping it. If a test fails, it goes back to the previous version by itself, and the routing lists keep the previous policy if a check fails.

Details for your IT team

  • Engine: sing-box, running on the router with a TUN interface so every LAN device is covered without per-device setup.
  • Protocol: VLESS-REALITY to Throughwire's servers.
  • Platforms: GL.iNet stock firmware with no reflashing, or a package for OpenWrt 24.10 and 25.12. Minimum arm64 or armv7, 256 MB RAM, 30 MB free storage.
  • Install path: the installer runs on the laptop, downloads pinned and checked assets from our own site, and pushes them to the router over the LAN. It authenticates with a single-use code and the router's admin password; the subscription link is never shown.
  • Split routing: mainland China domains and IP ranges go direct; everything else, including unknown destinations, goes through the tunnel. International names are resolved through the tunnel; Chinese names use the local resolver. BitTorrent goes direct, and QUIC to international sites is blocked so browsers use HTTPS over TCP.
  • Updates: a signed update channel for software and routing lists, verified on the router, self-tested, with automatic rollback.
  • Failure behaviour: forwarding is blocked if the tunnel stops (a kill switch), and the service restarts on its own after reboots and power cuts.